mirror of
https://github.com/HolgerHatGarKeineNode/einundzwanzig-app.git
synced 2026-05-05 04:54:53 +00:00
Claude
9b81f6cd92
- Add 60 req/min throttle to the public API group and a stricter 10 req/min throttle to POST /highscores. - Replace mass-assigned $guarded=[] with explicit $fillable on User, Meetup, Course, Lecturer, and SelfHostedService. created_by stays out of the whitelist; the existing creating() hooks continue to populate it. - Require authenticated user on Api/MeetupController::index instead of trusting the user_id query parameter (IDOR). - Constrain the /img and /img-public route paths to a safe character set and reject any path containing ".." in ImageController. - Add rel="noopener noreferrer" to every target="_blank" link on the meetup and course landing pages.
94 lines
2.4 KiB
PHP
94 lines
2.4 KiB
PHP
<?php
|
|
|
|
namespace App\Models;
|
|
|
|
use App\Enums\SelfHostedServiceType;
|
|
use Illuminate\Database\Eloquent\Factories\HasFactory;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
use Illuminate\Database\Eloquent\Relations\BelongsTo;
|
|
use Illuminate\Support\Facades\Cookie;
|
|
use Spatie\Image\Enums\Fit;
|
|
use Spatie\MediaLibrary\HasMedia;
|
|
use Spatie\MediaLibrary\InteractsWithMedia;
|
|
use Spatie\MediaLibrary\MediaCollections\Models\Media;
|
|
use Spatie\Sluggable\HasSlug;
|
|
use Spatie\Sluggable\SlugOptions;
|
|
use Spatie\Tags\HasTags;
|
|
|
|
class SelfHostedService extends Model implements HasMedia
|
|
{
|
|
use HasFactory;
|
|
use HasSlug;
|
|
use HasTags;
|
|
use InteractsWithMedia;
|
|
|
|
/**
|
|
* @var array<int, string>
|
|
*/
|
|
protected $fillable = [
|
|
'name',
|
|
'slug',
|
|
'type',
|
|
'intro',
|
|
'url_clearnet',
|
|
'url_onion',
|
|
'url_i2p',
|
|
'url_pkdns',
|
|
'ip',
|
|
'contact',
|
|
'anon',
|
|
];
|
|
|
|
protected $casts = [
|
|
'id' => 'integer',
|
|
'created_by' => 'integer',
|
|
'type' => SelfHostedServiceType::class,
|
|
'anon' => 'boolean',
|
|
];
|
|
|
|
protected static function booted(): void
|
|
{
|
|
static::creating(function ($model): void {
|
|
// Only set created_by if user is authenticated and not explicitly set as anonymous
|
|
if (auth()->check() && ! isset($model->created_by)) {
|
|
$model->created_by = auth()->id();
|
|
}
|
|
});
|
|
}
|
|
|
|
public function getSlugOptions(): SlugOptions
|
|
{
|
|
return SlugOptions::create()
|
|
->generateSlugsFrom(['name'])
|
|
->saveSlugsTo('slug')
|
|
->usingLanguage(Cookie::get('lang', config('app.locale')));
|
|
}
|
|
|
|
public function registerMediaConversions(?Media $media = null): void
|
|
{
|
|
$this
|
|
->addMediaConversion('preview')
|
|
->fit(Fit::Crop, 300, 300)
|
|
->nonQueued();
|
|
$this
|
|
->addMediaConversion('thumb')
|
|
->fit(Fit::Crop, 130, 130)
|
|
->width(130)
|
|
->height(130);
|
|
}
|
|
|
|
public function registerMediaCollections(): void
|
|
{
|
|
$this
|
|
->addMediaCollection('logo')
|
|
->acceptsMimeTypes(['image/jpeg', 'image/png', 'image/gif', 'image/webp'])
|
|
->singleFile()
|
|
->useFallbackUrl(asset('img/einundzwanzig.png'));
|
|
}
|
|
|
|
public function createdBy(): BelongsTo
|
|
{
|
|
return $this->belongsTo(User::class, 'created_by');
|
|
}
|
|
}
|